summaryrefslogtreecommitdiffhomepage
path: root/svr-runopts.c
diff options
context:
space:
mode:
Diffstat (limited to 'svr-runopts.c')
-rw-r--r--svr-runopts.c122
1 files changed, 92 insertions, 30 deletions
diff --git a/svr-runopts.c b/svr-runopts.c
index 2c65009..2c905dd 100644
--- a/svr-runopts.c
+++ b/svr-runopts.c
@@ -46,16 +46,19 @@ static void printhelp(const char * progname) {
"-b bannerfile Display the contents of bannerfile"
" before user login\n"
" (default: none)\n"
- "-r keyfile Specify hostkeys (repeatable)\n"
+ "-r keyfile Specify hostkeys (repeatable)\n"
" defaults: \n"
#if DROPBEAR_DSS
- " dss %s\n"
+ " - dss %s\n"
#endif
#if DROPBEAR_RSA
- " rsa %s\n"
+ " - rsa %s\n"
#endif
#if DROPBEAR_ECDSA
- " ecdsa %s\n"
+ " - ecdsa %s\n"
+#endif
+#if DROPBEAR_ED25519
+ " - ed25519 %s\n"
#endif
#if DROPBEAR_DELAY_HOSTKEY
"-R Create hostkeys as required\n"
@@ -99,6 +102,10 @@ static void printhelp(const char * progname) {
"-W <receive_window_buffer> (default %d, larger may be faster, max 1MB)\n"
"-K <keepalive> (0 is never, default %d, in seconds)\n"
"-I <idle_timeout> (0 is never, default %d, in seconds)\n"
+#if DROPBEAR_PLUGIN
+ "-A <authplugin>[,<options>]\n"
+ " Enable external public key auth through <authplugin>\n"
+#endif
"-V Version\n"
#if DEBUG_TRACE
"-v verbose (compiled with DEBUG_TRACE)\n"
@@ -113,6 +120,9 @@ static void printhelp(const char * progname) {
#if DROPBEAR_ECDSA
ECDSA_PRIV_FILENAME,
#endif
+#if DROPBEAR_ED25519
+ ED25519_PRIV_FILENAME,
+#endif
MAX_AUTH_TRIES,
DROPBEAR_MAX_PORTS, DROPBEAR_DEFPORT, DROPBEAR_PIDFILE,
DEFAULT_RECV_WINDOW, DEFAULT_KEEPALIVE, DEFAULT_IDLE_TIMEOUT);
@@ -129,6 +139,9 @@ void svr_getopts(int argc, char ** argv) {
char* maxauthtries_arg = NULL;
char* keyfile = NULL;
char c;
+#if DROPBEAR_PLUGIN
+ char* pubkey_plugin = NULL;
+#endif
/* see printhelp() for options */
@@ -156,6 +169,10 @@ void svr_getopts(int argc, char ** argv) {
#if DROPBEAR_SVR_REMOTETCPFWD
svr_opts.noremotetcp = 0;
#endif
+#if DROPBEAR_PLUGIN
+ svr_opts.pubkey_plugin = NULL;
+ svr_opts.pubkey_plugin_options = NULL;
+#endif
#ifndef DISABLE_ZLIB
opts.compress_mode = DROPBEAR_COMPRESS_DELAYED;
@@ -274,6 +291,11 @@ void svr_getopts(int argc, char ** argv) {
case 'u':
/* backwards compatibility with old urandom option */
break;
+#if DROPBEAR_PLUGIN
+ case 'A':
+ next = &pubkey_plugin;
+ break;
+#endif
#if DEBUG_TRACE
case 'v':
debug_trace = 1;
@@ -394,6 +416,17 @@ void svr_getopts(int argc, char ** argv) {
if (svr_opts.forced_command) {
dropbear_log(LOG_INFO, "Forced command set to '%s'", svr_opts.forced_command);
}
+#if DROPBEAR_PLUGIN
+ if (pubkey_plugin) {
+ char *args = strchr(pubkey_plugin, ',');
+ if (args) {
+ *args='\0';
+ ++args;
+ }
+ svr_opts.pubkey_plugin = pubkey_plugin;
+ svr_opts.pubkey_plugin_options = args;
+ }
+#endif
}
static void addportandaddress(const char* spec) {
@@ -452,9 +485,9 @@ static void addportandaddress(const char* spec) {
static void disablekey(int type) {
int i;
TRACE(("Disabling key type %d", type))
- for (i = 0; sshhostkey[i].name != NULL; i++) {
- if (sshhostkey[i].val == type) {
- sshhostkey[i].usable = 0;
+ for (i = 0; sigalgs[i].name != NULL; i++) {
+ if (sigalgs[i].val == type) {
+ sigalgs[i].usable = 0;
break;
}
}
@@ -511,6 +544,13 @@ static void loadhostkey(const char *keyfile, int fatal_duplicate) {
}
#endif
#endif /* DROPBEAR_ECDSA */
+
+#if DROPBEAR_ED25519
+ if (type == DROPBEAR_SIGNKEY_ED25519) {
+ loadhostkey_helper("ed25519", (void**)&read_key->ed25519key, (void**)&svr_opts.hostkey->ed25519key, fatal_duplicate);
+ }
+#endif
+
sign_key_free(read_key);
TRACE(("leave loadhostkey"))
}
@@ -526,8 +566,10 @@ static void addhostkey(const char *keyfile) {
void load_all_hostkeys() {
int i;
- int disable_unset_keys = 1;
int any_keys = 0;
+#if DROPBEAR_ECDSA
+ int loaded_any_ecdsa = 0;
+#endif
svr_opts.hostkey = new_sign_key();
@@ -550,16 +592,13 @@ void load_all_hostkeys() {
#if DROPBEAR_ECDSA
loadhostkey(ECDSA_PRIV_FILENAME, 0);
#endif
- }
-
-#if DROPBEAR_DELAY_HOSTKEY
- if (svr_opts.delay_hostkey) {
- disable_unset_keys = 0;
- }
+#if DROPBEAR_ED25519
+ loadhostkey(ED25519_PRIV_FILENAME, 0);
#endif
+ }
#if DROPBEAR_RSA
- if (disable_unset_keys && !svr_opts.hostkey->rsakey) {
+ if (!svr_opts.delay_hostkey && !svr_opts.hostkey->rsakey) {
disablekey(DROPBEAR_SIGNKEY_RSA);
} else {
any_keys = 1;
@@ -567,42 +606,65 @@ void load_all_hostkeys() {
#endif
#if DROPBEAR_DSS
- if (disable_unset_keys && !svr_opts.hostkey->dsskey) {
+ if (!svr_opts.delay_hostkey && !svr_opts.hostkey->dsskey) {
disablekey(DROPBEAR_SIGNKEY_DSS);
} else {
any_keys = 1;
}
#endif
-
#if DROPBEAR_ECDSA
+ /* We want to advertise a single ecdsa algorithm size.
+ - If there is a ecdsa hostkey at startup we choose that that size.
+ - If we generate at runtime we choose the default ecdsa size.
+ - Otherwise no ecdsa keys will be advertised */
+
+ /* check if any keys were loaded at startup */
+ loaded_any_ecdsa =
+ 0
#if DROPBEAR_ECC_256
- if ((disable_unset_keys || ECDSA_DEFAULT_SIZE != 256)
- && !svr_opts.hostkey->ecckey256) {
+ || svr_opts.hostkey->ecckey256
+#endif
+#if DROPBEAR_ECC_384
+ || svr_opts.hostkey->ecckey384
+#endif
+#if DROPBEAR_ECC_521
+ || svr_opts.hostkey->ecckey521
+#endif
+ ;
+ any_keys |= loaded_any_ecdsa;
+
+ /* Or an ecdsa key could be generated at runtime */
+ any_keys |= svr_opts.delay_hostkey;
+
+ /* At most one ecdsa key size will be left enabled */
+#if DROPBEAR_ECC_256
+ if (!svr_opts.hostkey->ecckey256
+ && (!svr_opts.delay_hostkey || loaded_any_ecdsa || ECDSA_DEFAULT_SIZE != 256 )) {
disablekey(DROPBEAR_SIGNKEY_ECDSA_NISTP256);
- } else {
- any_keys = 1;
}
#endif
-
#if DROPBEAR_ECC_384
- if ((disable_unset_keys || ECDSA_DEFAULT_SIZE != 384)
- && !svr_opts.hostkey->ecckey384) {
+ if (!svr_opts.hostkey->ecckey384
+ && (!svr_opts.delay_hostkey || loaded_any_ecdsa || ECDSA_DEFAULT_SIZE != 384 )) {
disablekey(DROPBEAR_SIGNKEY_ECDSA_NISTP384);
- } else {
- any_keys = 1;
}
#endif
-
#if DROPBEAR_ECC_521
- if ((disable_unset_keys || ECDSA_DEFAULT_SIZE != 521)
- && !svr_opts.hostkey->ecckey521) {
+ if (!svr_opts.hostkey->ecckey521
+ && (!svr_opts.delay_hostkey || loaded_any_ecdsa || ECDSA_DEFAULT_SIZE != 521 )) {
disablekey(DROPBEAR_SIGNKEY_ECDSA_NISTP521);
+ }
+#endif
+#endif /* DROPBEAR_ECDSA */
+
+#if DROPBEAR_ED25519
+ if (!svr_opts.delay_hostkey && !svr_opts.hostkey->ed25519key) {
+ disablekey(DROPBEAR_SIGNKEY_ED25519);
} else {
any_keys = 1;
}
#endif
-#endif /* DROPBEAR_ECDSA */
if (!any_keys) {
dropbear_exit("No hostkeys available. 'dropbear -R' may be useful or run dropbearkey.");
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-21 14:16:56 +0000